Bug 135084 - Crash on undo ucrtbase abort
Summary: Crash on undo ucrtbase abort
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected) release
Hardware: All All
: medium normal
Assignee: Not Assigned
Keywords: bibisectRequest, regression
: 131804 135414 (view as bug list)
Depends on:
Blocks: Crash
  Show dependency treegraph
Reported: 2020-07-23 21:05 UTC by Telesto
Modified: 2021-10-04 00:50 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:
Regression By:

Example file (10.43 KB, application/vnd.oasis.opendocument.text)
2020-07-23 21:06 UTC, Telesto

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2020-07-23 21:05:52 UTC
Crash on undo ucrtbase abort

Steps to Reproduce:
1. open the attached file
2. Insert a chart
3. Delete chart
5. Backspace

Actual Results:

Expected Results:
No crash

Reproducible: Always

User Profile Reset: No

Additional Info:
Found in
Version: (x64)
Build ID: 52820b52b3bca45e2db527d1cc5f4488b2e0b9d0
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL


not in 
Build ID: 62ad5818884a2fc2e5780dd45466868d41009ec0
Comment 1 Telesto 2020-07-23 21:06:12 UTC
Created attachment 163462 [details]
Example file
Comment 2 Telesto 2020-07-23 21:34:08 UTC
*** Bug 131804 has been marked as a duplicate of this bug. ***
Comment 3 Dieter 2021-03-28 09:59:03 UTC
Telesto, it seems, that nobody could confirm this bug since more than one year. So Iā€˜d like to ask, if it is still reproducible for you. Could you please try to reproduce it with a master build from http://dev-builds.libreoffice.org/daily/master/current.html? I have set the bug's status to 'NEEDINFO'. Please change it back to 'UNCONFIRMED' if the bug is still present in the latest version.
Comment 4 QA Administrators 2021-09-26 03:57:55 UTC Comment hidden (obsolete)
Comment 5 raal 2021-10-02 09:40:59 UTC
I can reproduce crash with Version: / LibreOffice Community
Build ID: b63c5ade3554a42def4bce94f9fd67ea66528214
CPU threads: 4; OS: Linux 5.11; UI render: default; VCL: gtk3
Locale: cs-CZ (cs_CZ.UTF-8); UI: en-US
Calc: threaded
Comment 6 raal 2021-10-02 10:05:53 UTC
This seems to have begun at the below commit.
Adding Cc: to XXX ; Could you possibly take a look at this one?
 0918a0c29b494e043480b9f1ed3f032524968d59 is the first bad commit
commit 0918a0c29b494e043480b9f1ed3f032524968d59
Author: Matthew Francis <mjay.francis@gmail.com>
Date:   Sun Mar 15 03:51:36 2015 +0800

    commit 47a2d7642d249d70b5da0c330a73f3a0032e4bba
    Author:     Juan Picca <jumapico@gmail.com>
    AuthorDate: Fri Sep 19 14:19:30 2014 -0300
    Commit:     David Tardon <dtardon@redhat.com>
    CommitDate: Thu Oct 9 11:33:33 2014 +0000
        fdo#81356: convert Fraction to boost::rational<long> - wip
        * Added rational util functions used by Fraction class not
          available in the boost::rational class.
        * Replaced usage of Fraction by boost::rational<long>
        * Removed code that relies on:
          1. fraction.IsValid() -- rational only allow valid values, ie
             denominator() != 0
          2. rational.denominator() == 0 -- always false
          3. rational.denominator() < 0 -- always false but implementation
             detail: http://www.boost.org/doc/libs/release/libs/rational/rational.html#Internal%20representation
        * Simplified code that relies on:
          1. rational.denominator() != 0 -- always true
        * BUGS EXIST because Fraction allows the creation of invalid values but
          boost::rational throws the exception boost::bad_rational
Comment 7 raal 2021-10-02 10:06:47 UTC
Adding Cc: to Juan Picca
Comment 8 raal 2021-10-02 14:36:54 UTC
*** Bug 135414 has been marked as a duplicate of this bug. ***
Comment 9 Juan Picca 2021-10-03 03:26:38 UTC
Hi all.

1. I can't reproduce the bug in 

Version: / LibreOffice Community
Build ID: 20(Build:2)
CPU threads: 4; OS: Linux 5.14; UI render: default; VCL: gtk3
Locale: es-UY (en_US.UTF-8); UI: en-US
Debian package version: 1:7.2.1-4
Calc: threaded

2. The mentioned commit was reverted:

commit 31af61ea091cc895b893c849f2130aa35792b7db                                  
Author: Jan Holesovsky <kendy@collabora.com>                                     
Date:   Thu Oct 23 17:41:47 2014 +0200                                           
    Fraction: Revert "fdo#81356: convert Fraction to boost::rational<long> - wip"
    This reverts commit 47a2d7642d249d70b5da0c330a73f3a0032e4bba.                
    Change-Id: I4849916f5f277a4afef0e279b0135c76b36b9d15

Comment 10 raal 2021-10-03 07:40:11 UTC
I can reproduce the crash with LO 7.3. There is message in CLI 
terminate called after throwing an instance of 'boost::wrapexcept<boost::bad_rational>'
  what():  bad rational: zero denominator
Comment 11 Juan Picca 2021-10-04 00:50:14 UTC
Hi raal.

It is possible for you run writer under gdb to obtain a stack trace?
I suspect that the problem is with the code that try to create an invalid fraction (zero denominator).

Maybe we can add a check before the creation of the fraction.